Cisco CCNA 200-301 v1.1 & NetAcad v7.02 / v8 Exam Portal

Verified Final Exam Answers, Interactive Practice Mode, IOS CLI Cheat Sheets & Packet Tracer (.PKA) Labs.

Home » Verified Interactive Exam Module

CCNA 1 v7.02 & v8 (ITN) Complete Final Exam Answers (Full 52-Question Master Bank 2026)

Updated: October 17, 2026 • Tip: Click any option (A, B, C, D) to check your answer instantly!

Master the official CCNA 1 v7.02 & v8 (Introduction to Networks - ITN) Final Exam with our complete 52-Question Verified Bank covering every module from Layer 2 Ethernet to IPv4/IPv6 Subnetting and IOS Security.

📥 Download CCNA 1 v7.02 & v8 (ITN) Complete Final Exam Answers (Full 52-Question Master Bank 2026) Packet Tracer (.PKA) & Verified PDF Guide

Includes complete Cisco NetAcad v7.02 / v8 topology file (.pka) and IOS CLI configuration script.

Verified Cisco NetAcad Exam Questions (62 Core Questions + Explanations)

Question 1 Which interface allows remote management of a Layer 2 switch?
  • A. The AUX interface
  • B. The console port interface
  • C. The switch virtual interface (SVI)
  • D. The first Ethernet port interface
✔ Correct Answer: C. The switch virtual interface (SVI)
Technical Explanation: A Layer 2 switch uses a Switch Virtual Interface (SVI), such as interface VLAN 1 or a dedicated management VLAN interface, assigned with an IPv4/IPv6 address to allow remote management over Telnet/SSH.
Question 2 What function does pressing the Tab key have when entering a command in IOS?
  • A. It aborts the current command and returns to configuration mode.
  • B. It exits configuration mode and returns to user EXEC mode.
  • C. It moves the cursor to the beginning of the next line.
  • D. It completes the remainder of a partially typed word in a command.
✔ Correct Answer: D. It completes the remainder of a partially typed word in a command.
Technical Explanation: Pressing the Tab key in the Cisco IOS CLI auto-completes a partially typed command keyword if enough characters have been typed to make it unique.
Question 3 While trying to solve a network issue, a technician made multiple changes to the current router configuration file. The changes did not solve the problem and were not saved. What action can the technician take to discard the changes and work with the file in NVRAM?
  • A. Issue the 'reload' command without saving the running configuration.
  • B. Delete the vlan.dat file and reboot the device.
  • C. Close and reopen the terminal emulation software.
  • D. Issue the 'copy startup-config running-config' command.
✔ Correct Answer: A. Issue the 'reload' command without saving the running configuration.
Technical Explanation: Issuing 'copy startup-config running-config' merges the two configs rather than overwriting. To completely discard unsaved changes in RAM and load the clean configuration from NVRAM, issue the 'reload' command and decline saving changes.
Question 4 Which two traffic types use the Real-Time Transport Protocol (RTP)? (Choose two.)
  • A. Video
  • B. Web
  • C. File transfer
  • D. Voice
  • E. Peer-to-peer
✔ Correct Answer: A. Video & D. Voice
Technical Explanation: RTP operates over UDP to carry latency-sensitive streaming media such as Voice over IP (VoIP) and video teleconferencing.
Question 5 Which layer of the TCP/IP model provides a route to forward messages through an internetwork?
  • A. Application
  • B. Network Access
  • C. Internet
  • D. Transport
✔ Correct Answer: C. Internet
Technical Explanation: The TCP/IP Internet layer corresponds to the OSI Network layer (Layer 3) and handles logical IP addressing and packet routing across networks.
Question 6 What is a characteristic of fault-tolerant networks?
  • A. They protect data from unauthorized access.
  • B. They have redundant links that rapidly reroute traffic if a primary path fails.
  • C. They can expand quickly to support new users without degrading performance.
  • D. They prioritize voice traffic over web traffic.
✔ Correct Answer: B. They have redundant links that rapidly reroute traffic if a primary path fails.
Technical Explanation: Fault tolerance relies on redundant hardware and alternate paths in a packet-switched network so that a single point of failure does not interrupt communications.
Question 7 Which command encrypts all plaintext passwords in the running-config file on a Cisco router or switch?
  • A. enable secret
  • B. service password-encryption
  • C. security passwords min-length 10
  • D. crypto key generate rsa
✔ Correct Answer: B. service password-encryption
Technical Explanation: The 'service password-encryption' global configuration command applies weak Type 7 obfuscation to all unencrypted passwords (console, VTY, aux) in the configuration output.
Question 8 What is the Protocol Data Unit (PDU) associated with the Data Link layer (Layer 2) of the OSI model?
  • A. Segment
  • B. Packet
  • C. Frame
  • D. Bits
✔ Correct Answer: C. Frame
Technical Explanation: OSI PDUs from Layer 4 down to Layer 1 are: Segment/Datagram (Layer 4 - Transport), Packet (Layer 3 - Network), Frame (Layer 2 - Data Link), and Bits (Layer 1 - Physical).
Question 9 Which type of network topology lets an administrator see the actual physical location of intermediary devices and cable installations?
  • A. Logical topology
  • B. Physical topology
  • C. Subnet topology
  • D. VLAN topology
✔ Correct Answer: B. Physical topology
Technical Explanation: A physical topology diagram illustrates the physical placement of racks, cabling, rooms, and ports, whereas a logical topology shows IP schemes, VLANs, and routing boundaries.
Question 10 Why would a Layer 2 switch need an IP address configured on an SVI?
  • A. To enable the switch to route packets between different VLANs.
  • B. To enable the switch to be managed remotely via SSH or Telnet.
  • C. To allow connected PCs to use the switch as their default gateway.
  • D. To enable the switch to build its MAC address table.
✔ Correct Answer: B. To enable the switch to be managed remotely via SSH or Telnet.
Technical Explanation: A Layer 2 switch switches frames based solely on MAC addresses, so its IP address is strictly for remote management access (SSH, Telnet, SNMP, HTTP).
Question 11 What command is used to verify the condition of the switch interfaces, including the status of the interfaces and a configured IP address?
  • A. ipconfig
  • B. ping
  • C. traceroute
  • D. show ip interface brief
✔ Correct Answer: D. show ip interface brief
Technical Explanation: 'show ip interface brief' provides a concise summary of all router/switch interfaces, their assigned IPv4 addresses, Layer 1 Status, and Layer 2 Protocol state.
Question 12 Which access method would be most appropriate if you are in the equipment room with a new switch that needs to be configured for the first time?
  • A. Console
  • B. Telnet
  • C. SSH
  • D. AUX
✔ Correct Answer: A. Console
Technical Explanation: Out-of-band serial or USB console access is required for initial configuration of a brand-new switch that has no IP address or active network interfaces.
Question 13 What happens when part of an Internet transmission is not delivered to the destination in a TCP-based communication?
  • A. The entire message is dropped and the connection is reset.
  • B. The source is notified via ICMP and stops sending.
  • C. Only the missing TCP segments are retransmitted by the source.
  • D. The destination reconstructs the missing bytes using FCS.
✔ Correct Answer: C. Only the missing TCP segments are retransmitted by the source.
Technical Explanation: TCP uses sequence numbers and acknowledgments (ACKs) to track segment delivery and reliably retransmit only lost segments.
Question 14 Which organization is responsible for overseeing the allocation of IPv4 and IPv6 addresses and managing DNS root zones globally?
  • A. IEEE
  • B. IANA / ICANN
  • C. EIA/TIA
  • D. ITU-T
✔ Correct Answer: B. IANA / ICANN
Technical Explanation: IANA (operated by ICANN) coordinates global IP address allocation to Regional Internet Registries (RIRs), protocol parameters, and DNS root zone management.
Question 15 A user is implementing security on a small office network. Which two actions would provide the minimum security requirements for this network? (Choose two.)
  • A. Installing a wireless network
  • B. Implementing a firewall and antivirus software
  • C. Adding a dedicated intrusion prevention device
  • D. Switching to fiber-optic cabling
  • E. Disabling DHCP
✔ Correct Answer: B. Implementing a firewall and antivirus software
Technical Explanation: For a SOHO/small office environment, host-based antivirus/antimalware software combined with a stateful network firewall provides essential baseline security.
Question 16 What is the purpose of the FCS field in an Ethernet frame?
  • A. To obtain the MAC address of the sending node
  • B. To verify the logical address of the sending node
  • C. To compute the CRC header for the data field
  • D. To determine if errors occurred in the transmission and reception of the frame
✔ Correct Answer: D. To determine if errors occurred in the transmission and reception of the frame
Technical Explanation: The Frame Check Sequence (FCS) trailer uses a 32-bit Cyclic Redundancy Check (CRC) calculation so the receiving NIC can detect corrupted frames and drop them.
Question 17 Which switching method drops frames that fail the FCS check?
  • A. Store-and-forward switching
  • B. Cut-through switching
  • C. Fast-forward switching
  • D. Borderless switching
✔ Correct Answer: A. Store-and-forward switching
Technical Explanation: Store-and-forward switching buffers the entire Ethernet frame, calculates the CRC against the FCS trailer, and discards any corrupted frames or runts/giants before forwarding.
Question 18 What is the auto-MDIX feature on a Cisco Catalyst switch?
  • A. Automatic configuration of an interface for 10/100/1000 Mb/s operation
  • B. Automatic configuration of an interface for a straight-through or a crossover Ethernet cable connection
  • C. Automatic configuration of full-duplex operation over a single optical cable
  • D. The ability to turn a switch interface on or off if a loop is detected
✔ Correct Answer: B. Automatic configuration of an interface for a straight-through or a crossover Ethernet cable connection
Technical Explanation: Auto-MDIX detects the required cable pinout (transmit/receive pairs) and automatically adjusts the port internally, eliminating the need to worry about crossover vs. straight-through cables.
Question 19 What will a host on an Ethernet network do if it receives a frame with a unicast destination MAC address that does not match its own MAC address?
  • A. It will discard the frame.
  • B. It will forward the frame to the next host.
  • C. It will remove the frame from the media.
  • D. It will strip off the data-link frame to check the destination IP address.
✔ Correct Answer: A. It will discard the frame.
Technical Explanation: When a NIC receives an Ethernet frame whose destination MAC does not match the NIC's burned-in MAC, broadcast (FF-FF-FF-FF-FF-FF), or subscribed multicast MAC, it drops the frame at Layer 2 without interrupting the CPU.
Question 20 Which two statements describe the features or functions of the Logical Link Control (LLC) sublayer in Ethernet standards? (Choose two.)
  • A. Logical Link Control is implemented in software.
  • B. Logical Link Control is specified in the IEEE 802.3 standard.
  • C. The LLC sublayer adds a header and a trailer to the data.
  • D. The Data Link layer uses LLC to communicate with the upper layers of the protocol suite.
  • E. LLC is responsible for the placement and retrieval of frames on and off the media.
✔ Correct Answer: A. Logical Link Control is implemented in software. & D. The Data Link layer uses LLC to communicate with the upper layers of the protocol suite.
Technical Explanation: The IEEE 802.2 LLC sublayer is implemented in software/drivers and identifies which Network Layer protocol (IPv4, IPv6, ARP) is encapsulated inside the frame.
Question 21 What is the minimum Ethernet frame size that will not be discarded by the receiver as a runt frame?
  • A. 46 bytes
  • B. 64 bytes
  • C. 128 bytes
  • D. 1518 bytes
✔ Correct Answer: B. 64 bytes
Technical Explanation: The valid IEEE 802.3 Ethernet frame size ranges from 64 bytes (minimum) to 1518 bytes (maximum, excluding VLAN tagging). Any frame smaller than 64 bytes is discarded as a collision fragment (runt).
Question 22 How does a Layer 2 switch build its MAC address table?
  • A. By inspecting the destination MAC address of incoming frames.
  • B. By inspecting the source MAC address of incoming frames and recording the ingress port.
  • C. By sending ARP broadcasts out all active switch ports.
  • D. By downloading the table from the default gateway router.
✔ Correct Answer: B. By inspecting the source MAC address of incoming frames and recording the ingress port.
Technical Explanation: Switches learn MAC addresses dynamically by reading the Source MAC address of every incoming frame and mapping it to the ingress port in the CAM table.
Question 23 What is the special destination MAC address used by an IPv4 broadcast Ethernet frame?
  • A. 00-00-00-00-00-00
  • B. FF-FF-FF-FF-FF-FF
  • C. 01-00-5E-00-00-01
  • D. 33-33-00-00-00-01
✔ Correct Answer: B. FF-FF-FF-FF-FF-FF
Technical Explanation: An Ethernet broadcast frame uses a destination MAC address of all 1s in binary (FF-FF-FF-FF-FF-FF in hexadecimal), which causes switches to flood it out all ports in the VLAN.
Question 24 What is the primary benefit of twisting the wire pairs inside a UTP Ethernet cable?
  • A. It makes the copper wires stronger against physical pulling.
  • B. It reduces crosstalk and electromagnetic interference (EMI/RFI) through magnetic field cancellation.
  • C. It allows more wires to fit inside an RJ-45 connector.
  • D. It increases the voltage level of the electrical signal.
✔ Correct Answer: B. It reduces crosstalk and electromagnetic interference (EMI/RFI) through magnetic field cancellation.
Technical Explanation: Twisting opposing circuit wires together causes their electromagnetic fields to cancel each other out, protecting the signal from external EMI and internal pair-to-pair crosstalk.
Question 25 Why is Single-Mode Fiber (SMF) preferred over Multimode Fiber (MMF) for long-distance campus backbones and WAN links?
  • A. SMF uses cheaper LED light sources.
  • B. SMF has a much larger core diameter (62.5 microns).
  • C. SMF uses a laser light source and a single light path (9-micron core), eliminating modal dispersion over distances up to tens of kilometers.
  • D. SMF does not require glass cladding.
✔ Correct Answer: C. SMF uses a laser light source and a single light path (9-micron core), eliminating modal dispersion over distances up to tens of kilometers.
Technical Explanation: Single-mode fiber has a tiny 9-micron core that allows only a single ray of laser light to travel straight down the fiber, preventing dispersion and supporting long-haul links.
Question 26 What is the default aging timer for dynamic entries in a Cisco Catalyst switch MAC address table?
  • A. 30 seconds
  • B. 180 seconds
  • C. 300 seconds (5 minutes)
  • D. 3600 seconds (1 hour)
✔ Correct Answer: C. 300 seconds (5 minutes)
Technical Explanation: By default, Cisco switches keep dynamically learned MAC address entries in the CAM table for 300 seconds (5 minutes) after the last frame is received from that source MAC.
Question 27 Which cut-through switching method offers the lowest latency by forwarding a frame immediately after reading the 6-byte destination MAC address?
  • A. Fragment-free switching
  • B. Fast-forward switching
  • C. Store-and-forward switching
  • D. CRC-checked switching
✔ Correct Answer: B. Fast-forward switching
Technical Explanation: Fast-forward switching begins forwarding the frame as soon as the destination MAC address is read, offering the lowest possible latency (whereas fragment-free waits for the first 64 bytes).
Question 28 Which Layer 2 media access control method is used by 802.11 Wireless LANs (Wi-Fi) to avoid collisions on shared half-duplex radio frequencies?
  • A. CSMA/CD
  • B. CSMA/CA
  • C. Token Passing
  • D. Full-Duplex Point-to-Point
✔ Correct Answer: B. CSMA/CA
Technical Explanation: Wireless networks operate in half-duplex and cannot detect collisions while transmitting, so they use Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) and RTS/CTS.
Question 29 What happens when one side of an Ethernet link is configured for Full-Duplex and the other side is set to Half-Duplex?
  • A. The link automatically negotiates 10 Gbps speed.
  • B. A duplex mismatch occurs, causing late collisions, FCS errors, and severely degraded throughput.
  • C. Both ports immediately enter the err-disabled state.
  • D. The link converts to a Layer 3 routed port.
✔ Correct Answer: B. A duplex mismatch occurs, causing late collisions, FCS errors, and severely degraded throughput.
Technical Explanation: A duplex mismatch causes the full-duplex end to transmit at any time while the half-duplex end sees simultaneous transmissions as collisions, resulting in late collisions and packet loss.
Question 30 Which destination MAC address prefix is reserved for IPv4 multicast frames?
  • A. 01-00-5E
  • B. 33-33-00
  • C. FF-FF-FF
  • D. FE-80-00
✔ Correct Answer: A. 01-00-5E
Technical Explanation: IPv4 multicast packets map their lower 23 bits into the Ethernet MAC address prefix 01-00-5E-xx-xx-xx (whereas IPv6 multicast uses 33-33-xx-xx-xx-xx).
Question 31 When a router forwards an IPv4 packet from one interface to another on the path toward a remote destination, which two header fields change at every hop? (Choose two.)
  • A. Source IPv4 Address
  • B. Destination IPv4 Address
  • C. Source and Destination Layer 2 MAC Addresses
  • D. IPv4 Time-to-Live (TTL) and Header Checksum
  • E. TCP Destination Port
✔ Correct Answer: C. Source and Destination Layer 2 MAC Addresses & D. IPv4 Time-to-Live (TTL) and Header Checksum
Technical Explanation: Source and Destination IP addresses remain constant end-to-end (unless NAT is performed). At each router hop, the Layer 2 frame is stripped and rewritten with new source/destination MAC addresses, and the IPv4 TTL is decremented by 1 (requiring a new IPv4 Header Checksum).
Question 32 What is the primary enhancement in the IPv6 packet header compared to the IPv4 header?
  • A. IPv6 adds a variable-length Options field to every packet.
  • B. IPv6 uses a simplified, fixed 40-byte header with fewer fields and no header checksum, improving router forwarding efficiency.
  • C. IPv6 reduces the address size from 128 bits to 32 bits.
  • D. IPv6 requires routers to fragment oversized packets en route.
✔ Correct Answer: B. IPv6 uses a simplified, fixed 40-byte header with fewer fields and no header checksum, improving router forwarding efficiency.
Technical Explanation: IPv6 removes unnecessary fields (including the Header Checksum and router fragmentation fields) to create a fixed 40-byte header that hardware routers process much faster.
Question 33 What is the purpose of the Address Resolution Protocol (ARP) in an IPv4 network?
  • A. To resolve a known domain name (FQDN) into an IPv4 address.
  • B. To resolve a known IPv4 address on the local subnet into its corresponding Layer 2 MAC address.
  • C. To dynamically assign IPv4 addresses to new hosts.
  • D. To discover the MAC address of a remote web server across the Internet.
✔ Correct Answer: B. To resolve a known IPv4 address on the local subnet into its corresponding Layer 2 MAC address.
Technical Explanation: ARP broadcasts an ARP Request on the local LAN ('Who has IP X?') to discover the 48-bit Ethernet MAC address required to encapsulate the Layer 2 frame.
Question 34 If PC1 (192.168.1.10/24) wants to send a packet to a web server at 203.0.113.50, what destination MAC address will PC1 place in the Ethernet frame header?
  • A. The MAC address of the web server 203.0.113.50
  • B. The broadcast MAC address FF-FF-FF-FF-FF-FF
  • C. The MAC address of PC1's Default Gateway router interface (e.g., 192.168.1.1)
  • D. The MAC address of the local DNS server
✔ Correct Answer: C. The MAC address of PC1's Default Gateway router interface (e.g., 192.168.1.1)
Technical Explanation: When the destination IP is on a remote network, the host encapsulates the packet inside a Layer 2 frame addressed to the MAC address of its local Default Gateway router.
Question 35 In the output of 'show ip route' on a Cisco router, what do the codes 'C' and 'L' indicate?
  • A. 'C' indicates a directly connected network subnet; 'L' indicates the specific /32 local IPv4 address assigned to the router interface.
  • B. 'C' indicates a Cisco proprietary route; 'L' indicates a legacy RIP route.
  • C. 'C' indicates a converged OSPF route; 'L' indicates a loopback-only route.
  • D. 'C' indicates a static default route; 'L' indicates a link-local route.
✔ Correct Answer: A. 'C' indicates a directly connected network subnet; 'L' indicates the specific /32 local IPv4 address assigned to the router interface.
Technical Explanation: Since Cisco IOS 15+, activating an interface with an IP address adds two entries to the routing table: 'C' (Connected network prefix) and 'L' (Local host route with a /32 mask for the interface's own IP).
Question 36 Which protocol replaces IPv4 ARP in an IPv6 network by using ICMPv6 Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages?
  • A. DHCPv6
  • B. Neighbor Discovery Protocol (NDP)
  • C. OSPFv3
  • D. NAT64
✔ Correct Answer: B. Neighbor Discovery Protocol (NDP)
Technical Explanation: IPv6 eliminates broadcast ARP and uses ICMPv6 Neighbor Discovery Protocol (NDP) with solicited-node multicast addresses to resolve IPv6 addresses to MAC addresses.
Question 37 What is a security risk associated with ARP broadcasts on a local Ethernet LAN?
  • A. Threat actors can send gratuitous/forged ARP replies to poison the ARP cache of hosts (ARP Spoofing / Man-in-the-Middle attack).
  • B. ARP requests automatically traverse WAN routers across the Internet.
  • C. ARP encrypts traffic using weak DES keys.
  • D. ARP disables port security on Catalyst switches.
✔ Correct Answer: A. Threat actors can send gratuitous/forged ARP replies to poison the ARP cache of hosts (ARP Spoofing / Man-in-the-Middle attack).
Technical Explanation: Because ARP is stateless and unauthenticated, an attacker on the LAN can send spoofed ARP replies claiming to have the Default Gateway's IP address, intercepting all traffic.
Question 38 Which command must be entered on a Cisco router before it will forward IPv6 packets between interfaces?
  • A. ip routing
  • B. ipv6 unicast-routing
  • C. ipv6 enable
  • D. no ipv6 shutdown
✔ Correct Answer: B. ipv6 unicast-routing
Technical Explanation: By default, Cisco IOS routers forward IPv4 packets automatically, but IPv6 routing is disabled until the 'ipv6 unicast-routing' global configuration command is entered.
Question 39 What happens to an IPv4 packet when its Time-to-Live (TTL) field reaches zero at a router?
  • A. The router resets the TTL to 255 and forwards the packet.
  • B. The router drops the packet and sends an ICMP Time Exceeded message back to the source IP address.
  • C. The router buffers the packet until the destination responds.
  • D. The router floods the packet out all interfaces.
✔ Correct Answer: B. The router drops the packet and sends an ICMP Time Exceeded message back to the source IP address.
Technical Explanation: To prevent infinite routing loops, every router decrements TTL by 1. If TTL reaches 0, the router discards the packet and returns an ICMPv4 Type 11 (Time Exceeded) message to the sender.
Question 40 Which field in the IPv6 header is equivalent to the IPv4 Time-to-Live (TTL) field?
  • A. Next Header
  • B. Hop Limit
  • C. Flow Label
  • D. Traffic Class
✔ Correct Answer: B. Hop Limit
Technical Explanation: IPv6 renames the 8-bit TTL field to 'Hop Limit', which accurately reflects its function of counting router hops rather than seconds.
Question 41 When configuring a router GigabitEthernet interface, which command activates the physical port from its default 'administratively down' state?
  • A. enable
  • B. active
  • C. no shutdown
  • D. port up
✔ Correct Answer: C. no shutdown
Technical Explanation: Unlike switch ports (which are active by default), Cisco router interfaces are shut down by default and require the 'no shutdown' interface configuration command.
Question 42 Which command on a Windows PC displays the local routing table?
  • A. ipconfig /all
  • B. netstat -r (or route print)
  • C. arp -a
  • D. tracert
✔ Correct Answer: B. netstat -r (or route print)
Technical Explanation: Running 'netstat -r' or 'route print' in Windows Command Prompt displays the host's IPv4 and IPv6 routing tables, including the active default gateway (0.0.0.0/0).
Question 43 How many usable host IPv4 addresses are available on the 192.168.10.128/26 subnet?
  • A. 30
  • B. 62
  • C. 64
  • D. 126
✔ Correct Answer: B. 62
Technical Explanation: A /26 mask leaves 6 host bits (32 - 26 = 6). Total usable hosts = 2^6 - 2 = 64 - 2 = 62 hosts (range 192.168.10.129 to 192.168.10.190, broadcast 192.168.10.191).
Question 44 What is the subnet address and broadcast address for a host with the IPv4 address 172.16.45.200/27?
  • A. Network: 172.16.45.192, Broadcast: 172.16.45.223
  • B. Network: 172.16.45.128, Broadcast: 172.16.45.255
  • C. Network: 172.16.45.192, Broadcast: 172.16.45.207
  • D. Network: 172.16.45.0, Broadcast: 172.16.45.255
✔ Correct Answer: A. Network: 172.16.45.192, Broadcast: 172.16.45.223
Technical Explanation: A /27 prefix increments in blocks of 32 in the fourth octet (0, 32, 64, 96, 128, 160, 192, 224). Therefore, 200 falls inside the 172.16.45.192/27 subnet, whose broadcast is 172.16.45.223.
Question 45 Which three IPv4 address ranges are reserved by RFC 1918 for private internal networks and cannot be routed on the public Internet? (Choose three.)
  • A. 10.0.0.0/8
  • B. 172.16.0.0/12 (172.16.0.0 – 172.31.255.255)
  • C. 192.168.0.0/16
  • D. 169.254.0.0/16
  • E. 127.0.0.0/8
  • F. 224.0.0.0/4
✔ Correct Answer: A. 10.0.0.0/8, B. 172.16.0.0/12, C. 192.168.0.0/16
Technical Explanation: RFC 1918 defines three private IPv4 blocks: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. (169.254.0.0/16 is APIPA link-local, and 127.0.0.0/8 is loopback).
Question 46 What is the fully compressed representation of the IPv6 address 2001:0db8:0000:0000:0ab0:0000:0000:0100?
  • A. 2001:db8::ab0::100
  • B. 2001:db8::ab0:0:0:100
  • C. 2001:db8:0:0:ab:0:0:1
  • D. 2001:0db8::ab0:0:0:0100
✔ Correct Answer: B. 2001:db8::ab0:0:0:100
Technical Explanation: Rule 1: Omit leading zeros in each hextet (0db8 -> db8, 0ab0 -> ab0, 0100 -> 100, but never omit trailing zeros!). Rule 2: Use the double colon (::) only ONCE in an address to replace a contiguous string of all-zero hextets.
Question 47 Which IPv6 address type is used for one-to-nearest communication, where multiple devices share the same address and routers forward packets to the closest interface?
  • A. Unicast
  • B. Multicast
  • C. Anycast
  • D. Broadcast
✔ Correct Answer: C. Anycast
Technical Explanation: IPv6 Anycast assigns the same unicast IPv6 address to multiple servers (such as DNS root servers), and routing protocols route client requests to the topologically nearest server.
Question 48 When an IPv6 host uses SLAAC (Stateless Address Autoconfiguration) to configure its own Global Unicast Address without a DHCPv6 server, which ICMPv6 message does it receive from the local router?
  • A. Router Solicitation (RS)
  • B. Router Advertisement (RA)
  • C. Neighbor Solicitation (NS)
  • D. Echo Reply
✔ Correct Answer: B. Router Advertisement (RA)
Technical Explanation: In SLAAC, the host sends an ICMPv6 Router Solicitation (RS) to FF02::2 (All-Routers multicast), and the router responds with a Router Advertisement (RA) containing the /64 network prefix and default gateway.
Question 49 Which subnet mask is best suited for a point-to-point WAN link between two routers to conserve IPv4 addresses while supporting broadcast?
  • A. 255.255.255.0 (/24)
  • B. 255.255.255.240 (/28)
  • C. 255.255.255.252 (/30)
  • D. 255.255.255.128 (/25)
✔ Correct Answer: C. 255.255.255.252 (/30)
Technical Explanation: A /30 mask (255.255.255.252) provides 2^2 - 2 = 2 usable host IP addresses, which is ideal for a point-to-point link between two router interfaces without wasting IPs.
Question 50 A Windows PC fails to contact a DHCPv4 server and automatically assigns itself the address 169.254.21.55/16. What type of address is this?
  • A. RFC 1918 Private Address
  • B. APIPA (Automatic Private IP Addressing) Link-Local Address
  • C. Loopback Address
  • D. Public Routable Address
✔ Correct Answer: B. APIPA (Automatic Private IP Addressing) Link-Local Address
Technical Explanation: When a DHCPv4 client cannot reach a DHCP server, Windows uses APIPA to self-assign a link-local address from the 169.254.0.0/16 block.
Question 51 Which ICMP message type is used by both the 'ping' and 'traceroute' utilities to test network reachability?
  • A. Destination Unreachable and Time Exceeded
  • B. Echo Request (Type 8) and Echo Reply (Type 0)
  • C. Router Solicitation and Router Advertisement
  • D. Source Quench
✔ Correct Answer: B. Echo Request (Type 8) and Echo Reply (Type 0)
Technical Explanation: Ping (and Windows tracert) sends ICMP Echo Request messages and listens for ICMP Echo Reply (or ICMP Time Exceeded from intermediate hops).
Question 52 What is the prefix length and hexadecimal prefix for IPv6 Unique Local Addresses (ULAs), which are the IPv6 equivalent of IPv4 private addresses?
  • A. 2000::/3
  • B. FE80::/10
  • C. FC00::/7 (commonly FD00::/8)
  • D. FF00::/8
✔ Correct Answer: C. FC00::/7 (commonly FD00::/8)
Technical Explanation: IPv6 Unique Local Addresses (FC00::/7, typically starting with FD) are used for internal site addressing and are not routable on the global IPv6 Internet.
Question 53 In VLSM (Variable Length Subnet Masking), why must you always allocate subnets starting from the largest host requirement down to the smallest?
  • A. To prevent overlapping address blocks and ensure proper boundary alignment.
  • B. Because Cisco routers only accept /24 masks first.
  • C. To force all WAN links into the first subnet.
  • D. Because DHCP servers cannot lease addresses from small subnets.
✔ Correct Answer: A. To prevent overlapping address blocks and ensure proper boundary alignment.
Technical Explanation: Sorting subnet requirements from largest to smallest ensures each block aligns cleanly on its bit boundary without overlapping previously assigned smaller subnets.
Question 54 Which two characteristics describe UDP (User Datagram Protocol) compared to TCP? (Choose two.)
  • A. Connectionless transport with low overhead (8-byte header)
  • B. Guaranteed delivery using three-way handshakes and windowing
  • C. Best-effort delivery with no retransmission of lost datagrams
  • D. Flow control via sliding windows
  • E. Sequencing and acknowledgment of every packet
✔ Correct Answer: A. Connectionless transport with low overhead (8-byte header) & C. Best-effort delivery with no retransmission of lost datagrams
Technical Explanation: UDP is a lightweight, connectionless Layer 4 protocol with an 8-byte header that does not establish sessions or retransmit dropped packets, making it ideal for DNS, DHCP, VoIP, and TFTP.
Question 55 What are the three steps of the TCP Three-Way Handshake used to establish a reliable session?
  • A. SYN -> ACK -> FIN
  • B. SYN -> SYN-ACK -> ACK
  • C. REQUEST -> OFFER -> ACK
  • D. HELLO -> INIT -> FULL
✔ Correct Answer: B. SYN -> SYN-ACK -> ACK
Technical Explanation: The client sends a SYN segment, the server replies with a SYN-ACK segment, and the client completes the handshake with an ACK segment.
Question 56 Which well-known port numbers are used by HTTP, HTTPS, SSH, Telnet, and DNS respectively?
  • A. HTTP: 80, HTTPS: 443, SSH: 22, Telnet: 23, DNS: 53
  • B. HTTP: 21, HTTPS: 8080, SSH: 23, Telnet: 22, DNS: 67
  • C. HTTP: 80, HTTPS: 443, SSH: 25, Telnet: 110, DNS: 161
  • D. HTTP: 443, HTTPS: 80, SSH: 20, Telnet: 21, DNS: 53
✔ Correct Answer: A. HTTP: 80, HTTPS: 443, SSH: 22, Telnet: 23, DNS: 53
Technical Explanation: Memorizing well-known TCP/UDP ports is mandatory for CCNA: FTP (20/21), SSH (22), Telnet (23), SMTP (25), DNS (53 TCP/UDP), DHCP (67/68 UDP), TFTP (69 UDP), HTTP (80), POP3 (110), SNMP (161/162), HTTPS (443).
Question 57 What is the correct four-step order of messages exchanged when a client obtains an IPv4 address from a DHCPv4 server?
  • A. DHCPDISCOVER -> DHCPOFFER -> DHCPREQUEST -> DHCPACK (DORA)
  • B. DHCPREQUEST -> DHCPOFFER -> DHCPACK -> DHCPFIN
  • C. DHCPOFFER -> DHCPDISCOVER -> DHCPREQUEST -> DHCPACK
  • D. ARP Request -> DHCPOFFER -> DHCPACK -> Gratuitous ARP
✔ Correct Answer: A. DHCPDISCOVER -> DHCPOFFER -> DHCPREQUEST -> DHCPACK (DORA)
Technical Explanation: DHCPv4 follows the DORA process: Discover (broadcast by client), Offer (from server), Request (broadcast by client selecting the offer), and Acknowledgment (ACK from server).
Question 58 Which three commands are required on a Cisco router before you can generate RSA keys for SSH access? (Choose three.)
  • A. Configure a non-default hostname (e.g., hostname R1)
  • B. Configure a DNS domain name (e.g., ip domain-name cisco.com)
  • C. Generate the keys using 'crypto key generate rsa'
  • D. Enable Telnet on VTY lines
  • E. Configure OSPF routing
✔ Correct Answer: A. Configure a non-default hostname, B. Configure a DNS domain name, C. Generate the keys using 'crypto key generate rsa'
Technical Explanation: Cisco IOS combines the router's hostname and IP domain-name (e.g., R1.cisco.com) to label the RSA key pair generated by 'crypto key generate rsa'.
Question 59 Which Cisco IOS command blocks brute-force login attempts by shutting down login access for 120 seconds if 3 failed attempts occur within 60 seconds?
  • A. login block-for 120 attempts 3 within 60
  • B. security passwords min-length 10
  • C. exec-timeout 2 0
  • D. transport input ssh
✔ Correct Answer: A. login block-for 120 attempts 3 within 60
Technical Explanation: The 'login block-for [seconds] attempts [tries] within [seconds]' global configuration command mitigates dictionary/brute-force attacks against VTY and console lines.
Question 60 What is the purpose of the 'exec-timeout 5 30' command configured under 'line vty 0 4'?
  • A. It disconnects an idle SSH/Telnet session after 5 minutes and 30 seconds of inactivity.
  • B. It limits the total duration of any SSH connection to 5 hours and 30 minutes.
  • C. It requires a password between 5 and 30 characters long.
  • D. It delays login prompts by 5.3 seconds.
✔ Correct Answer: A. It disconnects an idle SSH/Telnet session after 5 minutes and 30 seconds of inactivity.
Technical Explanation: 'exec-timeout [minutes] [seconds]' automatically logs out inactive administrative sessions to prevent unattended terminals from being hijacked.
Question 61 Which command displays the neighboring Cisco devices directly connected to a router, including their Device ID, local interface, and hardware platform?
  • A. show ip route
  • B. show cdp neighbors
  • C. show arp
  • D. show interfaces
✔ Correct Answer: B. show cdp neighbors
Technical Explanation: Cisco Discovery Protocol (CDP) is a Layer 2 Cisco proprietary protocol enabled by default that discovers directly connected Cisco switches, routers, and IP phones.
Question 62 When troubleshooting network connectivity from a PC, an engineer can ping 127.0.0.1 and the PC's own IP (192.168.1.50), but cannot ping the Default Gateway (192.168.1.1). Where does the problem most likely reside?
  • A. The remote web server is offline.
  • B. The DNS server is misconfigured.
  • C. There is a Layer 1/Layer 2 issue on the local LAN (unplugged cable, wrong switch VLAN, or shut down router interface).
  • D. The PC's TCP/IP stack is corrupted.
✔ Correct Answer: C. There is a Layer 1/Layer 2 issue on the local LAN (unplugged cable, wrong switch VLAN, or shut down router interface).
Technical Explanation: Pinging 127.0.0.1 proves the PC's TCP/IP stack works. Failing to reach the local default gateway indicates a physical cabling fault, wrong VLAN assignment on the switch port, or a shut-down gateway interface.

Complete CCNA 1 (ITN) Final Skills Exam CLI Reference

Cisco IOS CLI - Verification & Lab Script 
R1# show ip route
R1# show ipv6 route
R1# show ip interface brief
R1# show cdp neighbors detail
R1# copy running-config startup-config

🔥 Related Cisco CCNA Practice Portals & Simlet Banks

Continue your certification preparation across our verified partner study portals:

📘 CCNA Final Exam Archive↗ 📗 Pass-CCNA Practice Tests↗ 📙 Scaling & Routing Labs↗ 🏆 Pass4Sure CCNA Simlets↗
🎯 Live Practice Score: 0 / 0